Penetration testing cost: what a pentest runs, and what runs free first

You searched for a price and got a shrug: "it depends." It does depend, but not so much that a number is impossible. A pentest has a real market rate, the things that move it up or down are knowable, and there is a specific trap at the bottom of the price range worth naming before you buy. Here is the honest version, from a tool that sits one tier below a pentest and tells people so.

The actual numbers

For a web application in 2026, a penetration test typically runs $5,000 to $30,000. Small businesses and startups scoping a single app often land in the $3,000 to $15,000 band. The spread is wide because "pentest" covers everything from one small app to a whole infrastructure program, and the price tracks scope almost linearly.

The trap is at the bottom. A web-app pentest priced under about $3,000 is, in practice, an automated vulnerability scan presented as manual testing. You get a list of known CVEs, which a tool generated in an hour, dressed up as a human assessment. That is not what a pentest is for, and paying pentest-adjacent money for scanner output is the most common way people waste this budget.

What moves the price

The quote you get is mostly a function of scope and depth. The levers are:

• How much is in scope. The number of applications, user roles, endpoints, cloud accounts, and IPs. More surface, more days, higher price.
• Depth of testing. A surface pass is cheaper than a deep, chained-exploit assessment where the tester tries to break in the way a real attacker would.
• Authentication and roles. Testing logged-in functionality across several user roles is more work than testing a public marketing site.
• Tester seniority. A senior tester who finds business-logic flaws costs more than a junior running tools, and is worth it.
• Retesting and reporting. Whether the price includes a re-test after you fix things, and how formal the report needs to be for compliance.

None of this is mysterious once you see it. A pentest is priced in tester-days, and everything above changes how many days the job takes.

Why it costs what it costs

A pentest is expensive because it is a skilled human, not a tool. A scanner pattern-matches; a person reasons about your specific app, understands that order_id 1003 belongs to a different customer, and chains a handful of small issues into a real breach. That judgment is what you are paying for, and it is genuinely the deepest form of security testing there is. When you handle real money or sensitive data and have meaningful authenticated functionality, it is worth the money.

But it is a point-in-time snapshot you buy occasionally, not a thing you run on every deploy. Which raises the obvious question: what covers the gap between pentests, and what do you check before you are ready to spend this at all?

What runs free first

Before you pay anyone to look deeply, close the holes a stranger can already see for nothing. A large share of what gets exploited in the wild is not a clever chained exploit. It is a /.env a bot downloaded, a secret key sitting in a JavaScript bundle, a database table with no access rule, a missing security header. None of that needs a pentest to find. It is visible from the open internet, and finding it is free.

The order that saves money is this: run a free external scan, fix what it finds, and then pay for a pentest so the expensive human hours go on the hard problems instead of rediscovering your public .env. There is no reason to spend $10,000 to be told a bot could already download your backup file.

That first, free layer is what SurfaceCheckr is. It reads your public surface the way an attacker does, grades it A through F, and re-checks on a schedule so a new leak shows up the day it ships, no login and no payload. It is not a pentest and does not pretend to be one: it finds what leaked, not whether your logic is sound. For the full comparison of what a passive scan, a DAST, and a pentest each find, and where the money actually goes, that breakdown sits right next door. Run the free check today; it costs nothing and it decides whether you even need the invoice yet.